Express Data Path

Content sourced from Wikipedia, licensed under CC BY-SA 3.0.

XDP, which stands for eXpress Data Path, is a fast way to send and receive network packets by using an eBPF-based program inside the Linux kernel. It bypasses much of the usual Linux networking stack to handle packets at very high speeds. XDP has been part of the Linux kernel since version 4.8 and is licensed under the GPL.

How it works
XDP adds an early hook in the receive path (RX) of the kernel. This hook sits in the network interface card (NIC) driver right after the interrupt is processed and before the kernel allocates memory for the network stack. A user-supplied eBPF program decides what to do with each packet—drop it, modify it, pass it to the network stack, or redirect it elsewhere. Before the program runs, a preverifier checks that it is safe (no out-of-bounds access, no problematic loops, and no unsafe global variables). If the NIC or hardware supports XDP offload, the work can happen on the network card itself to reduce CPU load; if not, XDP can fall back to the normal network stack, which is slower.

Performance and hardware support
With XDP, a high volume of packets can be processed very quickly. On commodity hardware, it can reach very high rates, with claims of up to about 26 million packets per second per core. Offloading XDP processing to the NIC reduces CPU usage, though support for offload varies by hardware and driver. As of 2023, Netronome cards supported XDP offload.

Global support and implementations
XDP is developed with backing from major tech companies, including Amazon, Google, and Intel. Microsoft released an open-source version of XDP for Windows in May 2022 under the MIT license, and they are integrating XDP with their MsQuic implementation of the QUIC protocol.

AF_XDP and user-space processing
In parallel with XDP, a new Linux kernel feature called AF_XDP was introduced in version 4.18. It, formerly known as AF_PACKETv4, is a raw socket designed for high-performance packet processing and enables zero-copy data transfers between the kernel and user space. Because a single socket can be used for both receiving and transmitting, AF_XDP enables high-performance networking entirely in user space.